Yuva Defteri Privacy Policy and Information Notice

1. Data controller

This notice has been prepared by ESER TEKNOLOJİK PAZARLAMA ANONİM ŞİRKETİ (İsmet Kaptan Mah. Şair Eşref Bulv. No:18/82 Konak, İzmir, Türkiye) under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, to the extent applicable, the European Union General Data Protection Regulation (GDPR).

The information you write in Yuva Defteri is processed only on your and your family's devices. Your family keeps this information for its own use; we cannot see or process it. This notice explains where your information is kept and which technical data we or our service providers come across.

Requests and contact: info@mekanapp.com.

2. Account and identity

Yuva Defteri does not ask for your name, e-mail address or phone number, and does not create an account. The family is set up on a phone; the family name and the names of its members are kept only on the family's devices and never reach us. Another person joins your family by meeting in person and scanning a code; the parents approve the new person.

When the app is first opened, it creates encryption keys on the phone. These keys are protected in the phone's secure hardware and never leave the phone.

3. Information in the notebook

Everything you add to the notebook is kept encrypted: home information (Wi-Fi, boiler, building manager), devices and warranties, documents and their photos, contacts, health summary, medications, doses, appointments, emergency card, calendar and to-dos, passwords and secure notes in the Vault, the safety word, and what you ask @Yuva.

• Where it is kept: The information is kept encrypted on your phone. If your family uses more than one device, the information is kept only on your family's phones and on the Family Box in your home; it travels between devices end-to-end encrypted. We cannot see this information.
• Who sees it: Every item belongs to a section. Everyone in the family sees Whole Family, only parents see Parents, and only you see your Personal section. The Health section is seen by its owner and the people they choose; the Caregiver section is seen only by the caregiver the parents share it with. Parents cannot see a child's Personal section.
• Vault: Passwords and sensitive documents are protected with an additional key; your phone's lock or PIN is asked every time it is opened. To recover the Vault, a paper share is printed for you to keep outside the home.
• Health information is a special category of personal data. It can be kept only in Parents, the Vault or the person's own sections; it cannot be placed in Whole Family or shared with a caregiver. Add another adult's health information with their knowledge; ideally, they add it themselves.
• Information about others: Add the phone numbers and names of people outside the family, such as doctors, repair people or caregivers, only for your family's own use.

4. Artificial intelligence

• Document reading, extracting fields from documents, search and @Yuva run on your phone. If there is a suitable device in your home, long documents may also be read there; your approval is asked first, and asked again separately for health documents. Information in the Vault is never given to any device to read.
• Your questions, documents and photos are not sent to the cloud or to us. The models the app uses ship with the app; no model or code is downloaded later.
• Nothing the AI finds is saved without your approval. Fields filled in and answers given by the AI are shown with an "AI" label.
• @Yuva has no persona and gives no medical, legal or financial advice. For a medical question, it shows a fixed text that points you to a doctor or pharmacist and, in an emergency, to 112.
• What you ask is kept only in your Personal section, for 30 days by default; you can change the period or delete everything in Settings.
• The app has no microphone or speech recognition; you ask @Yuva by typing.

5. Camera, photos and code scanning

The camera is used to read the family join code and the Family Box code, and to photograph documents and medication boxes. Text and codes are read on your phone; the image is not sent to us or to any cloud. A long document is read on a device in your home only with your approval (see section 4). From your photo library, only the photo you select is read.

Code scanning, and on some phones the reading of document text, is performed on the phone itself with Google's ML Kit library. This library does not send the image, the text read or the code. However, on some phones it sends diagnostic data about its own operation, not linked to you, to its provider (United States); on other phones the app switches this off and the library sends nothing. The data sent is: the phone's manufacturer, model and operating system version, the app's name and version, a random installation number used only to count installations, processing time and error codes. The provider uses this data to measure the library's performance, fix its errors and prevent abuse. This data is not matched with your name, your family or the information in your notebook; we do not see it.

6. Technical data processed and service providers

• Family Box: A computer that stays on in your home; it is your family's own device and does not belong to us. It keeps an encrypted copy of the notebook, keeps devices in sync even when phones are off, and cannot read the content. If the parents allow it, the home computer may also do tasks such as reading a long document; in that case it sees only the document given to it for that task.
• Connection between devices: Your phones and the Family Box connect to each other end-to-end encrypted over your home network or the internet. Devices find each other over an open peer-to-peer network (HyperDHT) and connect directly where possible; public network nodes are used when first joining this network. If a direct connection cannot be made, the encrypted data may be passed through another node on the network. These nodes and other computers on the network may see your phone's IP address; they cannot see the content or which family you belong to. We do not operate any server on this network; we do not see or store your IP address.
• Provider of the code scanning library: the diagnostic data not linked to you described in section 5; United States.
• Notifications: Reminders are set up and run on your phone; notification content never goes to any server. The content of sensitive sections is not shown on the lock screen ("You have a reminder").
• Adding to the phone's calendar: This setting is off by default. If you turn it on, plans are written to the calendar you choose. If that calendar syncs to a cloud account, the plans also go to that account's provider; in that case the app asks you separately.
• E-mail to us: The "Report → Also send to us" or "Write to us" option opens a draft addressed to us in your e-mail app. The draft contains only the question and answer you see on the screen; notebook pages are not attached. You do the sending; we use the e-mail you send and your e-mail address only to reply and to review the report.
• Application marketplaces: distribution of the app; their own privacy policies apply.

7. Data not processed

We do not collect names, phone numbers, e-mail addresses (unless you write to us), contacts, location, voice recordings, advertising identifiers or the content of your notebook. The app contains no advertising, tracking, analytics or crash reporting software; the only exception is the code scanning library's own diagnostic data described in section 5, sent only on some phones. No face or fingerprint data is processed; face and fingerprint checks are performed on the phone itself.

8. Purposes and legal basis

The technical data described in this notice is processed only to provide the service and keep it secure: to connect your family's devices to each other, to make code scanning work correctly, to reply when you write to us, and to review reported AI answers.

Legal bases (KVKK art. 5/2): connecting devices to each other is necessary for the conclusion and performance of the contract (subparagraph c); the code scanning library's diagnostic data, processing of the e-mail you send us and the security of the service are based on our legitimate interest (subparagraph f). Under the GDPR, the corresponding bases are Art. 6(1)(b) and Art. 6(1)(f).

Transfers outside Türkiye: nodes on the direct connection network may be located in different countries and may see your IP address during a connection. The code scanning library's diagnostic data, not linked to you, goes to its provider's servers in the United States. The content of your notebook is not transferred abroad.

9. Retention and deletion

• Notebook information: until you delete it. When you delete a page, its encrypted records are cleared from the family's devices within one year at the latest; its file on the Family Box is deleted after 90 days. Copies may remain on the devices of family members who saw the page earlier.
• What you ask @Yuva: 30 days by default; can be changed or deleted in Settings.
• AI suggestions not yet approved: only on your phone, for at most 24 hours.
• Exported and opened files: deleted from the app's temporary folder after 10 minutes.
• IP address: not kept by us; we do not operate any server on this network.
• The code scanning library's diagnostic data: subject to its provider's own retention periods; we do not see or store this data.
• E-mails you send us: at most 1 year after your question or report is resolved.
• All data: Since there is no account, there is no account to delete on a server. When you remove the app from your phone, all notebook information on that phone is deleted. The Family Box is your own computer; you can remove the encrypted copy on it by deleting the Yuva files there. There is no cloud backup; the data is not included in the phone's own cloud backup either.

You can export the whole notebook at any time as a single password-protected file (Vault → Export, or Settings → Backup and recovery). The file format is open and can be opened with an open-source tool; even if the company closes, your information stays with your family.

10. Your rights

Under KVKK art. 11 and the GDPR, you have the right to learn whether your data is processed, to request information, to learn the purpose of processing and whether data is used accordingly, to know the third parties to whom it is transferred, and to request rectification, erasure, objection to automated processing and compensation for damage caused by unlawful processing.

Since the information in your notebook is on your own devices, you can correct, delete and export it yourself in the app. We hold no record that links you to your identity. For other requests: info@mekanapp.com. Requests are handled free of charge within 30 days at the latest.

11. Phone permissions

Permissions are requested only when you first use the related feature. No microphone, location or contacts permission is requested.

12. Children

Yuva Defteri may also be used within the family by children added by their parents; parents approve a child joining the family. Age is not recorded; the following rules apply to members with the child role:

• A child sees and writes only in Whole Family and their own Personal section; information in the Parents section is never shown to them.
• @Yuva does not chat with a child, has no persona, does not do homework and does not give general knowledge; it answers only from the family's notebook. There are no streaks, badges or notifications that pull the child back.
• What a child asks @Yuva is kept in their own Personal section; parents cannot see it, and no summary is sent to parents.
• On a difficult subject (for example, self-harm), @Yuva does not diagnose; with a fixed text it points the child to a trusted adult and to 112. Parents are not notified automatically.
• No additional data is collected from children. There is no advertising or tracking.

13. Security

Content is end-to-end encrypted, and the connection between devices is also end-to-end encrypted. Only standard, publicly available encryption methods are used. Keys are protected in the phone's secure hardware. You can turn on an optional app lock (PIN or your phone's lock: face, fingerprint or passcode). On screens that show Vault content, screenshots are blocked or the content is blurred in the app switcher; a copied password is cleared from the clipboard shortly afterwards. If a phone is lost, the parents in the family can remove that phone from the family.

14. Disclosure of artificial intelligence

In line with Article 50 of the European Union Artificial Intelligence Act, @Yuva says that it is an AI in the first conversation; every answer and every field filled in by the AI carries an "AI" label. When you share an answer, the first line of the shared text says so.

15. Changes

If this notice changes, this page is updated; significant changes are announced in the app. Effective date: the day the app is first published in the store. Last updated: 24 October 2026. In case of any discrepancy, the Turkish version prevails.